diff options
| author | James Morris <jmorris@namei.org> | 2008-12-19 11:41:10 +1100 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2008-12-20 09:03:39 +1100 |
| commit | 74192246910ff4fb95309ba1a683215644beeb62 (patch) | |
| tree | ff6daed6c494ac83afad70049a28f20ec5770b44 | |
| parent | 12204e24b1330428c3062faee10a0d80b8a5cb61 (diff) | |
SELinux: don't check permissions for kernel mounts
Don't bother checking permissions when the kernel performs an
internal mount, as this should always be allowed.
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
| -rw-r--r-- | security/selinux/hooks.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 7465d713b53..853b58c8b2c 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2484,6 +2484,10 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data) if (rc) return rc; + /* Allow all mounts performed by the kernel */ + if (flags & MS_KERNMOUNT) + return 0; + AVC_AUDIT_DATA_INIT(&ad, FS); ad.u.fs.path.dentry = sb->s_root; return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad); |